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[57] ABSTRACT 

A method of reprogramming memory storing program 
instruction code for controlling operation of a microproces- 
sor in which new data can l>e written to the memory by the 
microprocessor only in a write cycle and stored data can be 
read from the memory by the microprocessor only in a read 
cycle, the memory preventing the read cycle and said write 
cycle occurring at the same time is disclosed. The memory 
has first and second sectors for storing code, the first sector 
storing boot code for controlling operation of the micropro- 
cessor. The disclosed method includes the steps of erasing 
code stored in said second sector, writing new code includ- 
ing the boot code to the second sector, erasing the first sector, 
writing new boot code in the first sector preceded by an 
instruction to jump to said second sector and then rendering 
the jump instruction ineffective so that the next boot of the 
microprocessor will cause the microprocessor to be con- 
trolled by the new boot code in the first sector. 

11 Claims, 2 Drawing Sheets 
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ELECTRONIC APPARATUS INCLUDING A stored in the random access naemory. A signal then switches 

MEMORY DEVICE AND METHOD OF operation of the microprocessor from being under control of 

REPROGRAMMING THE MEMORY DEVICE code stored in the flash memory to being under control of the 

code stored in the random access memory. This switching 

BACKGROUND OF THE INVENTION 5 signal is a hardware signal. 

. , . 1 . • » • 1 -J- It will be appreciated that the random access memory is 

This mvenUon relates to electromc apparatus mcludmg a a * j » ^ .u • v 

, - f . • „„j •„ volatile and any data or code stored therem is lost when 

one or more memory devices for stormg data and m par- . • * • . j mu x .u »•„ „ 

. , , , / . - 1 J- „ power to the memory is termmated. While the entire pro- 

ticular to electromc apparatus including one or more ^ _ j • .-n * j • .u i . i « u 

11 J am L» J * gram instrucuon code is still stored in the non-volatile flash 

so-called "Flash memory devices. ^ . , . . *• i j-*- j 

10 memory, the system remams m an operational condition and 
Flash memory devices arc well known in the data pro- ^^^^ ^^^^^ restored the microprocessor will be operable 
cessing an and comprise cucuiis including semi-conductors ^^^^ ^^^^ ^^^^^ ^^^^^ program instruction code 
designed to store electrical signaU m a non-volatile manner. ^^^^^ ^ memory. However if the power supply fails 
That IS to say such memory devices conUnue to store signals ^ppjy ^^^^ ^^^^^^ ^ terminated, 
representing data even when electncal power to the circuit 15 program instruction code previously stored in the ran- 
is terminated. Unlike some other semi-conductor storage memory is lost and in addition the original 
devices used for non-volaule storage of data, flash memory program instruction code in the flash memory will have been 
devices have the capability of being reprogrammed,i.c. the ^^^^^^ parliaUy erased and only a part of the new 
data stored in flash memory devices can be erased and new instruction code written to the flash memory. Accordingly as 
data written into the memory, without removal of the device 20 a result of loss of power and consequent shut down of the 
from the electronic apparatus. Semi-conductor devices ^^^^^^ ^^^^ ^^^^^^ ^j^^^ system a complete 
which requu-e to be removed to enable reprogramming of the original program instruction code or complete new program 
device need to be removably mounted m a device socket and instruction code. Without a complete program instruction 
this leads to mcreased cost of manufacture of the apparatus ^^^^ ^he microprocessor is incapable of operating and the 
as well as a potential loss m reliability due to possible 25 system remains inoperative until such time as the flash 
resistance in the mterface between pins of the device and pin memory device is replaced or is reprogrammed by a different 
receiving sockets of the device socket. For reliability and j^^s convenient method, 
reduction in cost of manufacture it is desirable for the 

memory device to be permanently soldered, for example by SUMMARY OF THE INVENTION 
surface mounting, to electrical connections of a printed 30 

circuit board. According to one aspect of the invention in a method of 
Flash memory devices may be programmed prior to being reprogramming memory storing program instruction code 
soldered to the printed circuit board. When a flash memory controlhng operaUon of a microprocessor m which new 
device is utilised for storing program instruction code d"'* '° '^e memory by the microprocessor 
including boot software instniction code, a microprocessor 35 >•> » ^i'^ cycle and stored data can be read from the 
of the apparatus operating under the control of the program by the microprocessor only m a read cycle, said 
instrucuon code needs to read at least the boot code from the "^^V P'^^^ntmg the read cycle and said write cycle 
memory in order to perform functions including reprogram- occumng at the same Ume wherem the memory has at least 
ming of the memory. Accordingly in order to reprogram the S'^t second sectors for storing code, said first «:ctor 
memory it is necessary for the microprocessor to be able to 40 s»?"°g boot code for controlling operation of the 
read instruction code from the memory as well as to write microprocessor, the method includes the steps of erasing 
new instruction code into the memory. However flash code stored m said second sector; vmtmg new c»de to said 
memory devices do not permit programming or reprogram- «=<=°."d f^^^r, said new code including said boot code; 
ming of the memory at the same time as reading data or code er^mg the first sector, said fir^ sector when erased being in 
from the memory. Therefore it is necessary for the program 45 » ^l^^ such that the microprocessor in executing the boot 
instruction code, including the boot code, to be stored in "-de runs through to the boot code stored in the second 
another memory device from which the microprocessor can ^^^'i anting new boot code in said first sector preceded by 
read the program instruction code so as to operate under the "istmclion to jump to said ^nd sector and then 
code stored in the other memory device to perform the rendering the jump instruction ineffective whereby the next 
operations required for reprogramming the flash memory 50 boot of the microprocessor wUl cause the microprocessor to 
Therefore, in known electromc apparatus or systems incor- be controlled by said new boot code m said first sector, 
porating flash memory where the flash memory is intended According to another aspect of the invention electronic 
not to be removed from the apparatus for reprogramming, if apparatus includes memory reprogrammable by the method 
it is desired to reprogram the flash memory the apparatus is defined hereinbefore. The electronic apparatus may be post- 
provided with a separate memory device to hold 'boot' 55 age metering apparatus, 
software instruction code. Usually in microprocessor oper- 

ated electronic apparatus, random access memory is pro- BRIEF DESCRIPTION OF THE DRAWING 

vided for the temporary storage of data during operation of embodiment of the invention will now be described by 

the microprocessor. Accordingly the random access memory of example with reference to the drawings in which: 

may be used to store the program instruction code and the 60 ^ ^ ^ ^lock diagram of electronic apparatus com- 

microprocessor is operated under control of the iiKtruction . . ^ ^ ^ 

code stored in the random access memory while the repro- ^ « , »_ • , .• r 

gramming of the flash memory is effected. InitiaUy the ^ illustrates a flash memory havmg a plurahty of 

microprocessor, operating under the program instruction sectors, 

code stored in the flash memory, reads the code from the 65 FIG- 3 is a flow chart illustrating steps in reprogramming 

flash memory and writes the code to the random access the flash memory, and 

memory. Thus a copy of the program instruction code is FIG. 4 is a flow chart of a checking sub-routine. 
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DESCRIPTION OF THE PREFERRED 
EMBODIMENT 

Referring first to FIG. 1, the postage meter includes 
electronic accountiog and control means comprising a 
micro-processor 10 operating under program routines stored 
in a flash memory 11. A keyboard 12 is provided for input 
of commands and data by a user and a display 13 is provided 
to enable display of information to the user. A random access 
memory (RAM) 14 is provided for use as a working store for 
storage of temporary data during operation of the postage 
meter. Non- volatile duplicated memories 15, 16 are pro- 
vided for the storage of critical data relating to use of the 
postage meter and which is required to be retained even 
when the postage meter is not powered. The microprocessor 
10 carries out accounting functions in relation to use of the 
postage meter for franking mail items with postage charges 
applicable to handling of the mail items by the postal 
authority or another carrier. Accounting data relating to use 
of the posuge meter for printing franking impressions 
representing postage charges for mail items and any other 
critical data to be retained is stored in the non-volatile 
memories 15, 16. The accounting data includes a value of 
credit available for use by the meter in franking mail items, 
an accumulated total of value used by the meter in franking 
mail items, a count of the number of mail items franked by 
the meter and a count of the number of mail items franked 
with a postage charge in excess of a predetermined value. 
The value of credit is stored in a descending credit register, 
the accumulated total value is stored in an ascending tote 
register, the count of items is stored in an items register and 
the count of items franked with a postage charge in excess 
of a predetermined value is stored in a large items register. 
As is well known in the postage meter art, each of the 
registers referred to hereinbefore for storing accounting data 
is replicated in order to enable integrity of the accounting 
data to be maintained even in the event of a fault or 
termination of power to the meter during a franking opera- 
tion. Two replications of each of the registers are provided 
in each of the memory devices 15, 16. 

A motor controller 17 is controlled by the microprocessor 
to control operation of motors 18 driving feeding means (not 
shown) for feeding a mail item past a digital print head 19. 
Sensors 20 are provided to sense and monitor feeding of the 
mail item. An input/output port 21 is provided to enable 
commimication between the postage meter and external 
apparatus. A power supply 22 receiving power from a mains 
supply of electricity provides power at the required voltages 
to components of the postage meter. 

It will be appreciated that, as is well known in the postage 
meter art, the postage meter must operate in a secure manner 
and be protected from attempts to use the meter fraudulently 
for example by utilising the postage meter to print franking 
impressions on mail items for which no corresponding 
postage charge has been accounted for by the accounting 
means. Accordingly those parts of the postage meter 
required to be secured against unauthorised tampering are 
housed in a secure housing 23. 

Referring now to FIG. 2 and 3, FIG. 2 illustrates the 
sectored architecture of the flash memory device 11. In the 
illustration of FIG. 2 the memory is shown by way of 
example as having eight sectors 30 numbered 30^ to 308, 
however it is to be understood that the flash memory device 
may have a different number of sectors. When reprogram- 
ming the flash memory 11 only whole sectors 30 can be 
erased at any time. Initially the program instruction boot 
code is stored in sector 30^ and the microprocessor is 
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arranged to access this sector 30^ whenever the micropro- 
cessor is reset. Program instruction code, other than boot 
code is stored in one or more of the remaining sectors 3O2 
to SOg. 

5 When a reprogramming operation to write new code into 
the flash memory is to be performed, the boot code stored in 
sector 30^ is copied to RAM 14 and operation of the 
microprocessor is switched to be conuoUed by the boot code 
now stored in RAM 14. Then the code stored in all of the 

IQ sectors 3O2 to SOg is erased while leaving sector 30 ^ con- 
taining the boot code unerased. Reprogramming of sectors 
30^8 with new program instruction code is then commenced. 
The new programming instruction code includes, for storing 
at the top of sector SOj, a copy of the boot code already 

15 stored in sector 30^, If reprogramming is interrupted prior to 
completion of reprogramming of sectors 3O2 to 30g the code 
in these sectors will be incomplete or garbled. When the 
system is reset and the microprocessor is rebooted, the 
microprocessor is able to operate under the control of the 

20 boot code in sector 30j which up until now has not been 
erased or rewritten. As part of the routine performed under 
the control of the boot code, the microprocessor performs a 
sub-routine to check on the code in the flash memory as 
illustrated by FIG. 4. A checksum is performed in respect of 

25 the stored code and if the checksum of the code is OK, the 
microprocessor continues with normal program execution. 
However if the checksum is not OK, indicating incomplete 
or garbled code stored in sectors 3O2 SOg of the flash 
memory, the microprocessor re-enters the reprogramming 

30 routine and proceeds to perform the reprogramming 
sequence. 

When reprogramming of sectors 3O2 to 30^ has been 
completed successfully, as determined by the checksum 
subroutine of FIG. 4, reprogramming of sector 30j is com- 
as menced. Sector 30^ is erased. If reprogramming of sector 
30_| is interrupted at this stage the whole of sector 30^ 
contains microcode FF (hex), this being the microcode 
resulting from erasure of the storage locations in the sector. 
Therefore, upon reboot of the system after an interruption, 

40 the microprocessor will execute the sector 30^ containing FF 
(hex) and harmlessly continue until the program routine runs 
into the start of sector 3O2 which contains the boot code. 
Execution of the boot code will include carrying out the 
checksum sub-routine and detection of a bad code checksum 

45 in respect of sector 30-i will be detected. A further attempt to 
reprogram sector 30j will be made. 

Initially, in reprogramming sector 30^, the first bytes, for 
example three bytes, are left in the erased state of FF (hex). 
The next bytes, for example three bytes, are programmed 

50 with a jump instruction * JMP BOOT2' to cause the program 
to jump to the boot code of sector 3O2. The remainder of the 
sector 30j is reprogrammed with the boot code followed by 
any other code or data to be located in sector 30^. Finally 
when the code now programmed into sector 30j has been 

55 verified by the checksum sub-routine of FIG. 4, the first 
bytes of sector 30^ are programmed from FF (hex) to 'JMP 
BOOTr. Hence upon rebooting of the system, execution of 
the program will first encounter the jump instruction 'JMP 
BOOTr and the program will jump to the boot code located 

60 in sector 30^ immediately after the jump instruction *JMP 
B00T2* thereby by-passing this latter instruction. Thus it 
will be appreciated that apart from the relatively short lime 
period of the order of a few milliseconds when the instruc- 
tion *JMP B00T2' is progranmied into the flash memory 

65 and later during the equally short time period when the 
instruction *JMP BOOTl* is programmed into the memory, 
the flash memory contains frilly executable boot code and 
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the system can recover from any interniplion of reprogram- 
ming the flash memory. 

While the system described hereinbefore relates to repro- 
gramming of flash memory it is to be imderstood that it is 
also applicable to other forms of non-volatile memory in 5 
which the memory does not permit writing of new data into 
the memory at the same time as reading data from the 
memory. 

I claim: 

1. A method of reprogramming memory storing program 10 
instruction code for controlling operation of a microproces- 
sor in which new data can be written to the memory by the 
microprocessor only in a write cycle and stored data can be 
read from the memory only in a read cycle, said memory 
preventing the read cycle and said write cycle occurring at 15 
the same time wherein the memory includes at least first and 
second sectors for storing program instruction code, said 
first sector storing boot code for controlling operation of the 
microprocessor in a boot routine, the method including the 
steps of erasing program instruction code stored in said 20 
second sector; writing new program instruction code to said 
second sector, said new program instruction code including 
said boot code; erasing the first sector, said first sector when 
erased being in a state such that accessing of the first sector 
by the microprocessor in executing the boot routine causes 25 
execution of the boot routine to run through to the boot code 
stored in the second sector; writing in said first sector new 
boot code and an instruction to jump to said second sector; 
said jump instruction being executed in precedence to said 
new boot code; and then rendering the jump instruction 30 
ineffective whereby the next boot routine of the micropro- 
cessor causes the microprocessor to be controlled by said 
new boot code stored in said first sector 

2. A method as claimed in claim 1 wherein after writing 
the new program instruction code to the second sector and 35 
prior to erasing the first sector, the microprocessor carries 
out a step of determining if the new program instruction 
code has been successfully written in the second sector and 

in response to a determination that the new program instruc- 
tion code has been successfiiUy written in the second sector 40 
carries out the step of erasing the first sector. 

3. A method as claimed in claim 1 wherein after writing 
new boot code to the first sector, the microprocessor carries 
out a check to determine if the new boot code has been 
successfully written in the first sector. 45 

4. A method as claimed in claim 1 wherein the memory is 
non-volatile. 

5. A method as claimed in claim 1 wherein prior to 
commencement of the reprogramming of the memory, the 
boot code stored in the first sector is copied to a volatile 50 
memory device. 

6. Postage metering apparatus including memory repro- 
grammable by the method as claimed in claim 1. 

7. A method as claimed in any claim 4 wherein the 
memory is a flash memory device. 55 

8. A method of reprogramming memory storing program 
instruction code for controlling operation of a microproces- 
sor in which new data can be written to the memory by the 
microprocessor only in a write cycle and stored data can be 
read from the memory by the microprocessor only in a read 60 
cycle, said memory preventing the read cycle and said write 
cycle occurring at the same lime and wherein said memory 
includes a first sector and a second sector; said first sector 
comprising a plurality of storage locations storing first 
program instruction code including first boot code and said 65 
second sector storing second program instruction code 
including second boot code; said microprocessor in a boot 
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routine accessing the first sector to cause the microprocessor 
to be operated under control of said first boot code; 
the method including the steps of: 

erasing each said storage location of said first sector, 
then writing to first locations of said storage loca- 
tions of said first sector third program instruction 
code including third boot code; 

writing to a second location of said storage locations of 
the first sector a first jump instruction to jump to said 
second sector, said storage locations being accessed 
sequentially and said second location storing the first 
jump instruction being accessed in the sequential 
access earlier than accessing of said first storage 
locations storing the third boot code; and 

then rendering said first jump instruction ineffective 
whereby in a next succeeding boot routine the micro- 
processor accesses and executes the third boot code 
stored in said first storage locations of said first 
sector. 

9. A method as claimed in claim 8 wherein the first jump 
instruction is rendered ineffective by writing in a third 
location of the storage locations of the fir^ sector a second 
jump instruction to jump to a start of the third boot code 
stored in the first locations of the storage locations of the first 
sector, said third storage location being accessed in the 
sequential access earlier than accessing of the second loca- 
tion of the storage locations of the first sector. 

10. A method of reprogramming memory storing program 
instruction code for controlling operation of a microproces- 
sor in which new data can be written to the memory by the 
microprocessor only in a write cycle and stored data can be 
read from the memory by the microprocessor only in a read 
cycle, said memory preventing the read cycle and said write 
cycle occurring at the same time and wherein said memory 
includes a first sector and a second sector; said first sector 
comprising a plurality of storage locations storing first 
program instruction code including first boot code and said 
second sector storing second program instruction code 
including second boot code; said microprocessor in a boot 
routine accessing the first sector to cause the microprocessor 
to be operated under control of said first boot code; 

the method including the steps of: 

erasing each said storage location of said first sector, 
then writing to first locations of said storage loca- 
tions of said first sector third program instruction 
code including third boot code; 

writing to a second location of said storage locations of 
the first sector a first jump instruction to jump to said 
second sector, said storage locations being accessed 
sequentially and said second location storing the first 
jump instruction being accessed in the sequential 
access earlier than accessing of said first storage 
locations storing the third boot code to cause the 
microprocessor in a boot routine, prior to determi- 
nation that writing of said third program code is 
successful, to jump from the first sector to the second 
sector and thereby to be operated under control of the 
second boot code; 

determining if writing of the third program instruction 
code is successfiil and, if successful rendering said 
first jump instruction ineffective whereby in a next 
succeeding boot routine the microprocessor accesses 
and executes the third boot code stored in said first 
storage locations of said first sector. 

11. Electronic apparatus including a memory storing 
program instruction code and a microprocessor operable 
under control of said program instruction code, said memory 
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being accessible by the microprocessor in a write cycle to 
write code to the memory and in a read cycle to read code 
from the memory; said memory preventing said read cycle 
and said write cycle occurring at the same time; said 
memory including a first sector and a second sector; said first 5 
sector comprising a plurality or storage locations storing first 
program instruction code including first boot code and said 
second sector storing second program instruction code 
including second boot code; the microprocessor being 
operative in a boot routine to access the first sector and lo 
wherein the microprocessor is operable in a reprogramming 
routine lo: 

erase each said storage location of said first sector, then to 
write to first locations of said storage locations of said 
first sector third program instruction code including 



8 

third boot code and to write to a second location of said 
storage locations of the first sector a first jump instruc- 
tion to jump to said second sector, said storage loca- 
tions being accessed sequentiaUy by the microproces- 
sor and said second location storing the first jump 
instruction being accessed in the sequential access 
earlier than accessing of said first storage locations 
storing the third boot code; and 
then to render said first jump instruction ineffective 
whereby in a next succeeding boot routine the micro- 
processor accesses and executes the third boot code 
stored in said first storage locations of said first 
sector. 

« * * * « 
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